AT&T Data Breach Class Action Lawsuits

In March 2024, AT&T admitted to a significant data breach that exposed the personal information of approximately 73 million users. In July 2024, AT&T announced a second data breach of phone and text message records for more than 100 million customers. As a result, individual claims and AT&T data breach class action lawsuits were pursued against the carrier by current and former customers.

Internal evidence later revealed that AT&T was aware of the first data breach as early as August 2021, yet failed to take timely action to secure customer data or notify regulators, further increasing the potential for identity theft and fraud.

As a result, AT&T faced a wave of data breach lawsuits throughout 2024, with plaintiffs alleging that the company failed to take appropriate action to safeguard the personal data of current and former customers. The complaints highlight AT&T’s delays in acknowledging the breaches and notifying those affected, which plaintiffs argue left sensitive information exposed for an extended period.

Lawyers affiliated with AboutLawsuits are no longer reviewing new claims related to the AT&T data breach. The information provided on this page is for informational purposes only regarding previously filed lawsuits.

2025 AT&T Data Breach Lawsuit Updates: MDL 3114

March 4, 2025 Update: The AT&T data breach MDL continues to move forward, with the court granting a motion to set a deadline for filing the plaintiffs’ Consolidated Complaint. Plaintiffs must submit the complaint by March 31, 2025, which will outline the collective claims against AT&T and help shape the next phase of the litigation.

November 1, 2024 Update: A panel of federal judges has decided to consolidate all lawsuits over data breaches involving the cloud-based server company Snowflake as part of a single multidistrict litigation (MDL), which will include lawsuits against AT&T over the release of phone records and text messages of 110 million customers, as well as a Ticketmaster data breach involving personal information for more than 500 million individuals.

October 1, 2024 Update: The number of AT&T data breach class action lawsuits and individual claims continue to grow, as the JPML reported in its latest docket update that there are currently 71 claims pending in the AT&T Inc. Customer Data Security Breach Litigation

September 4, 2024 Update: Judge Brown issued a case management order appointing 11 attorneys to leadership roles, including a lead plaintiffs’ counsel, a liaison counsel, four for the Plaintiffs’ Executive Committee, and six for the Plaintiffs’ Steering Committee. These attorneys appointed to the AT&T data breach MDL will coordinate status updates, handle pretrial motions, conduct discovery and depositions on common issues, and potentially negotiate a settlement framework for the AT&T data breach claims.

August 12, 2024 Update: Following a second AT&T data breach announcement in July, the JPML has been asked to establish a separate multidistrict litigation for lawsuits over the AT&T wireless phone records leak, which involves a completely different security failure and may be centralized before a different judge in a different venue.

August 1, 2024 Update: In a case management order, Judge Brown announced she will be accepting applications from AT&T data breach attorneys to serve leadership roles in the litigation on the Plaintiff Steering Committee, which will take certain actions during the discovery process and pretrial proceedings that benefit all AT&T customers pursuing damages stemming from the data breach.

July 25, 2024 Update: As the the JPML works to transfer a growing number of data breach class action lawsuits to the newly established AT&T Inc. Customer Data Security Breach multidistrict litigation, Judge Ada Brown issued the first case management order on July 24, approving cases to be filed directly in the Northern District of Texas to promote efficiently in the litigation.

July 12, 2024 Update: In a report to the Securities and Exchange Commission (SEC), AT&T has announced yet another massive data breach indicating that hackers obtained phone numbers and the private call records of around 110 million customers through a cloud-based server company known as Snowflake, Inc. The indicates that it does not believe the data has been released to the public yet, and that AT&T is working with law enforcement.

June 6, 2024 Update: The JPML issued a transfer order on June 5, announcing that all AT&T class action lawsuits and individual claims will be consolidated in the U.S. District Court for the Northern District of Texas under Judge Ada E. Brown for coordinated and consolidated pretrial proceedings. In the order establishing the AT&T Inc. Customer Data Security Breach Litigation (MDL 3114), the judges indicated there are currently 12 class actions filed in three different district courts nationwide, with another 18 similar cases pending in seven other districts.

June 3, 2024 Update: As many await the JPML’s decision on whether to consolidate the growing number of AT&T data breach lawsuits into a MDL, another AT&T class action lawsuit was filed by Tiffany Sutherlin in the U.S. District Court for the Eastern District of Missouri, claiming the company became aware of the massive leak in 2021, but denied the data breach had happened until March 2024.

May 1, 2024 Update: Following the recent motion to consolidate AT&T lawsuits, the JPML is scheduled to hear oral arguments on whether to centralize AT&T claims filed throughout federal district courts nationwide at an upcoming hearing session on May 30, 2024, at the Orrin G. Hatch U.S. Courthouse in Salt Lake City, Utah.

April 29, 2024 Update: Given common questions of fact and law raised in a growing number of AT&T data breach lawsuits, a motion to transfer was filed with the U.S. Judicial Panel on Multidistrict Litigation (JPML) requesting that all claims filed throughout the federal district court system be consolidated for pretrial proceedings in the Northern District of Texas.

April 2, 2024 Update: Alex Petroski filed one of the first AT&T class action lawsuits in the U.S. District Court for the Northern District of Texas on April 2, claiming that the data breach was a direct result of AT&T’s failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect consumers’ personally identifiable information (PII) from a foreseeable and preventable cyber-attack.

March 30, 2024 Update: AT&T issued a press release regarding the data breach on March 30, disclosing that the 2021 data breach exposed the names, addresses, phone numbers, Social Security numbers, and email addresses of approximately 7.6 million current account holders and approximately 65.4 million former account holders.

AT&T Ignored Data Breach Warnings

AT&T first learned of the first data breach in August 2021, when the hacker group Shiny Hunters claimed to have accessed and intended to sell a database filled with sensitive customer data for approximately $1 million. Initially, AT&T disputed these claims, asserting that the leaked data samples shared by Shiny Hunters did not match their own records.

Instead of conducting a thorough investigation into the alleged breach and alerting customers and regulatory bodies as required by law, AT&T maintained that the breach claims were unfounded and did not notify its customers.

Almost three years later, a hacker known as “MajorNelson” publicly released the entire AT&T database for free on the dark web in late March 2024, exposing the names, addresses, phone numbers, Social Security numbers, and email addresses of approximately 7.6 million current account holders and approximately 65.4 million former account holders.

AT&T Admits to Massive Data Breach

After the data was released on March 30, 2024, a press release issued by AT&T admitted that the August 2021 data breach has exposed the names, addresses, phone numbers, Social Security numbers, and email addresses of approximately 7.6 million current account holders and approximately 65.4 million former account holders.

According to AT&T, the exposed data dates back to 2019 and earlier. However, the company has yet to identify the source of the unauthorized access to its systems that resulted in the massive exfiltration of customer data.

Despite the initial breach notification occurring years after the first alleged incident, AT&T has now begun sending Notice of Data Breach letters to customers with known compromised sensitive personal information. AT&T stated they are also offering complimentary identity theft and credit monitoring services to customers.

AT&T data breach lawsuits and class action claims sought damages on behalf of former customers, alleging that the company failed to adequately protect sensitive consumer data, potentially resulting in significant personal and financial harm. Critics argued that, despite known risks, AT&T may have prioritized its commercial interests over implementing stronger cybersecurity measures.

Second AT&T Data Breach Announced in July 2024

AT&T announced a second data breach impacting phone numbers and detailed call records of approximately 100 million customers on July 12, 2024.

The second AT&T data breach was reported to the Securities and Exchange Commission (SEC), revealing that hackers accessed the data through a cloud server provided by Snowflake, Inc., a company that stores data for AT&T and other large firms.

In addition to the SEC filing, AT&T informed its customers of the breach via a press release, indicating the breach originated several years ago but was only recently discovered.

According to AT&T, the compromised data encompasses records of phone calls and text messages for nearly all its cellular customers from May 1, 2022, to October 31, 2022, and on January 2, 2023. The data includes interactions between AT&T mobile numbers and AT&T landline numbers during these periods.

What Information was stolen in the AT&T Data Breach?

AT&T’s investigation into the data breach has identified that hackers stole the following customer information;

• Name
• Mailing Addresses
• Phone Number
• Social Security Number
• Date of Birth
• Phone Records
• Text Message Records
• AT&T account number and passcode

How was AT&T hacked?

For the two AT&T data breaches, the first breach was caused by hackers who accessed customer data through a cloud-based server operated by Snowflake, Inc. This server hosted data not only for AT&T but also for other major corporations.

The second breach, which involved a larger set of customer data, was also attributed to hackers exploiting vulnerabilities in AT&T’s systems

What to do if your information was stolen during the AT&T data breach

In response to the AT&T data breach, impacted customers are being urged to take proactive steps to secure their information. You should consider changing your AT&T account passcode immediately. Additionally, stay proactive by regularly checking your account activity and credit reports.

Setting up free fraud alerts with the major credit reporting agencies—Equifax, Experian, and TransUnion—can also be beneficial. Moreover, you have the right to obtain a free copy of your credit report annually from each of these agencies through AnnualCreditReport.com.

Is AT&T offering free identify theft monitoring?

Yes, AT&T is offering impacted customers a free one-year membership of Experian’s IdentityWorks, which includes credit monitoring, identity theft detection, and resolution services. This membership also comes with an insurance policy that provides coverage up to $1 million for identity theft incidents and access to an Identity Restoration team.

According to the Notice of Data Breach letters sent to AT&T customers, individuals will have until August 30, 2024 to activate their Experian’s IdentityWorks membership. To activate the membership, customers must visit the Experian® IdentityWorksSM website, click on ‘Get Started,’ and enter their activation code.

The services included in the one year Experian membership include;

• Experian Credit Report at Signup: Customers will receive a credit report after signing up to see the details associated with their credit profile.
• Credit Monitoring: This service will routinely check your Experian credit file for signs of fraudulent activity.
• Internet Surveillance: A dedicated technology continuously scans the internet, including chat rooms and bulletin boards, to detect if your personal information is being traded or sold on the dark web.
• Identity Restoration: If fraud is detected, specialists will assist with both credit and non-credit related fraud issues.
• Credit Lock/Unlock: You have the ability to lock or unlock your Experian credit file.
• $1 Million Identity Theft Insurance: Provides up to $1 million in insurance to cover costs related to identity theft recovery.

AT&T Data Breach Risks to Customers

If your personal information was stolen during the AT&T data breach, a hacker could use such information against you for;

• Identity Theft: With access to your social security number and other personal information, a hacker could potentially impersonate you to open new lines of credit, apply for loans, or obtain services in your name. This could damage your credit rating and cause financial loss.
• Financial Fraud: Hackers might access and drain your existing bank accounts, or use your information to deceive financial institutions into giving them access to your funds.
• Phishing Attacks: Using your personal details, a hacker could craft convincing phishing emails or messages that appear to come from legitimate sources. This can lead to further theft of your financial information or login credentials for various services.
• Account Takeover: With detailed personal information, it’s easier for attackers to answer security questions or request password resets on your existing accounts, ranging from social media to financial services, leading to unauthorized access.
• Tax Fraud: A hacker could use your social security number to falsely file tax returns in your name and steal tax refunds.
• Medical Identity Theft: Using your social security number and other personal details, an individual could potentially receive medical care under your identity, which can lead to medical bills charged to you and could corrupt your medical records.
• Utilities Fraud: The information could be used to set up utilities accounts (like electricity, water, and gas) in your name but at different addresses, possibly going unnoticed until debts are incurred.
• Legal Implications: Should the hacker commit crimes using your identity, you could be implicated or need to prove your innocence.
• Loss of Privacy: Knowing your home address and personal details, a hacker or malicious party could potentially harass you or even commit crimes such as stalking or burglary.
• Long-Term Security Risks: Even after the initial breach and potential immediate misuse of your information, the stolen data could be sold on the dark web, leading to ongoing risks and threats.

Real Customer Experiences: Impact of AT&T Data Breach on Fraud and Stolen Information

In the wake of the recent AT&T data breach, hundreds of customers have turned to the AboutLawsuits platform to share their firsthand accounts of the incident’s repercussions.

These AT&T data breach testimonials provide a deeply personal insight into the considerable impact of the data breach, revealing not only the vulnerabilities in personal security but also the profound effects on individual lives.

From instances of fraud to the unsettling theft of sensitive information, these stories underscore the far-reaching consequences of data security failures.

AT&T Data Breach Lawsuits

In April, a motion to transfer was submitted to the U.S. Judicial Panel on Multidistrict Litigation (JPML), requesting that all complaints filed throughout the federal district court system be consolidated for pretrial proceedings before one judge as part of an AT&T data breach lawsuit MDL (multidistrict litigation). The motion outlined the complexity of the breach and argues that consolidating the cases would help in managing the proceedings more efficiently, avoiding conflicting rulings, and easing the legal process for all parties involved.

The JPML heard oral arguments with the parties on May 30, and subsequently issued a transfer order on June 5, consolidating the claims in the U.S. District Court for the Northern District of Texas under Judge Ada E. Brown for coordinated pretrial proceedings.

Now that the MDL for the AT&T data breach lawsuits has been established, Judge Brown is expected to set a coordinated discovery schedule to investigate the release of customer information, possible preventive measures, and the duration of AT&T’s awareness of the issue.

Should negotiations fail to yield settlements for affected customers, the court may select a series of representative cases for early “bellwether” trials. These initial trials often provide insights into jury reactions to recurring evidence and testimony, influencing the broader litigation. If settlements are not reached during the MDL, individual claims may be sent back to their original U.S. District Courts for trial.

Allegations Raised in AT&T Lawsuits

The allegations raised in the AT&T data breach lawsuits focus on several key issues regarding the company’s handling of customer data:

• Negligence: Plaintiffs argue that AT&T failed to implement and maintain adequate security measures to protect customers’ sensitive personal information. This negligence is believed to have facilitated the unauthorized access and theft of data.
• Failure to Disclose Timely: There are claims that AT&T did not promptly notify affected customers about the breach, which potentially delayed individuals’ ability to take protective measures against identity theft and fraud.
• Breach of Contract: The lawsuits also allege that AT&T breached their contractual obligations to customers by failing to adequately secure their personal data, which is typically stipulated in service agreements.
• Unjust Enrichment: In some cases, the lawsuits accuse AT&T of unjust enrichment, suggesting that the company benefited financially from avoiding the costs associated with implementing adequate security measures.
• Violations of Consumer Protection Laws: Some claims specifically argue that AT&T’s actions violated specific state consumer protection laws by failing to safeguard consumer data adequately.

Examples of AT&T Data Breach Lawsuits

AT&T Phone Records Breach Lawsuit: Dina Winger filed and AT&T phone records breach lawsuit in the U.S. District Court for the Northern District of Texas on July 12, the same day the data breach was announced, seeking class action status to pursue damages on behalf of all affected customers. Winger claims she and other affected customers face an increased risk that they will suffer identify theft, fraud or even blackmail due to the theft of the personal information.

AT&T Data Breach Fraud Lawsuit: Stephen Head filed an AT&T lawsuit in the U.S. District Court for the Northern District of Texas on May 14, seeking class action status to pursue damages for himself and approximately 73 million other customers similarly situated.

According to the complaint, days before receiving the data breach notice from AT&T, Stephen Head noticed unauthorized debit card use and subsequently encountered a scammer posing as his bank seeking to confirm sensitive information. He further identified that someone was able to obtain a fraudulent loan for $3,579 from Navy Federal Credit Union in his name. Head claims that upon contacting AT&T to seek compensation for his financial losses and inconvenience, AT&T denied his claim and told him they would not pay for his damages.

AT&T Data Breach Class Action Lawsuit: Alex Petroski filed a class action lawsuit against AT&T in the Northern District of Texas on April 2, 2024, alleging that AT&T failed to maintain sufficient cyber-security measures, leading to a data breach. He claims that AT&T recklessly handled personally identifiable information (PII), leaving it vulnerable to cyberattacks despite knowing the risks. The lawsuit contends that AT&T did not take necessary steps to protect sensitive data, exposing it to potential threats.